Overview

overview

10

Static

static

5

6a6c055269...18.exe

windows7-x64

10

6a6c055269...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 09:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6a6c05526988d51e3f0af53789f40c08_JaffaCakes118.exe

  • Size

    512KB

  • MD5

    6a6c05526988d51e3f0af53789f40c08

  • SHA1

    ab8b60a0c858a9b1b774e4d3ec9daee87ebeea8f

  • SHA256

    4095c60bdb857d90c6ab19dc0dd248c23bd0e179ada792f8d2d6b4316de45154

  • SHA512

    ee4aa80c060ce7d943b3627d53cdae34907180b34e8b57af2920a69de4569db3876a972e7f93a6cf631e1fecd9cf744405e4594578a1fbe5e3802e3f447326c4

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6l:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a6c05526988d51e3f0af53789f40c08_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a6c05526988d51e3f0af53789f40c08_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\yiujeprxil.exe
      yiujeprxil.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Windows\SysWOW64\uxqzuhmd.exe
        C:\Windows\system32\uxqzuhmd.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4276
    • C:\Windows\SysWOW64\tsjkrcfnvwimfro.exe
      tsjkrcfnvwimfro.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2756
    • C:\Windows\SysWOW64\uxqzuhmd.exe
      uxqzuhmd.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1152
    • C:\Windows\SysWOW64\cyupuftcmbsqh.exe
      cyupuftcmbsqh.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3360
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    f3093a4507a090a9827e3bf40e2e31bc

    SHA1

    7978bc2dc463c970dc1b8dcda5817ebbfe181f27

    SHA256

    29eeb76dd2959c08962d0c702b5e508e45c8a643588665354335346c2ad07ae6

    SHA512

    3042caec83762d90dc46b2d5733377654c42e8f98ce3dbdf0319929d26cd1da4de8906d35ada61428ed6e0d2848f8e06c0f2a6d3f79940cfe98aaa885b571b03

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
    Filesize

    239B

    MD5

    1459a67e7603529e2bd4067a2a106783

    SHA1

    50364cbc787a8be7195e9f7847e1087a8426f3d7

    SHA256

    c989778e2fd3711e7ec2d1578a84da327ba9ef65015084c9f4fcf3e4c9e1a9cc

    SHA512

    b21324f7d9bbb59a64f178c735dd70496629ad0a08b2b5a6eee2346664104b03c13805102347cf5263f8b2e797f08fadaec01e231bc2db1f7716e1f7b257c373

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl
    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    5f7104907fbdb488624567e210db7cb3

    SHA1

    dea597ff9397c4d0556971e238ce19f7ac1efaca

    SHA256

    6fdd06c9b637af71b3ba91c0f527e3801e6a89d159a0ed262d9e048adbddb26a

    SHA512

    5ba1e30c79ef7fad45622bde02d05ebbe49f74769839fa7ddd91980e2a39ff96913ee8880efe7c6322fa989d067d40f0a684a8d3c81f791773b58a3d35898c80

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    3KB

    MD5

    b924028cf174fa7035063356ac9c50ae

    SHA1

    0314d30a2a58710539ce5771c5cb43139175371c

    SHA256

    92e4f5b9f74b0b14e12d1c8998daf9496bf2c9dde3cdd1415e30455fa3d13479

    SHA512

    f7d99d57bf071f9f667e288c36c4aa3f87d788f8b8d3e17be4c0b20d180eed7601ebb56f5449f805be4707a2cd9c13b699965203adf83cef6db712ee188877ab

    Download Submit
  • C:\Users\Admin\Documents\WaitPop.doc.exe
    Filesize

    512KB

    MD5

    b7f2dfe59a9b70e6696d9646081ebfa2

    SHA1

    748a45b56c12bc52d3a287b542c37af352ff5ed6

    SHA256

    180d7a8f66046e2233fe76ea97d4d27a892c5e1f90259aac3045882c58e8f93c

    SHA512

    d977bc3213e2f2be0a248a512585a238f521e0296b9ff3cb3b5438921ee92a31c908fb0235acbd7f306cf79314825f1396460cfe3d2390c82d6599d4c309c315

    Download Submit
  • C:\Windows\SysWOW64\cyupuftcmbsqh.exe
    Filesize

    512KB

    MD5

    fefe0fdd0d8a18b4a67d3bd382682161

    SHA1

    25ecc1e49efae112f069f5b4f2a5668ace6264b2

    SHA256

    882eb06e5383cdf069ee4ce76bc8e0ba9af79895a3682fda702c947cc805c460

    SHA512

    98676ddca054cc349e38b24541d5e3b68e1dfa1471e94947bee4730366686a2d128d28564af9dfd6d566dcdaffbae42b741aaf5d965b30be5947a113cee600f3

    Download Submit
  • C:\Windows\SysWOW64\tsjkrcfnvwimfro.exe
    Filesize

    512KB

    MD5

    dc0e4d7366597dacac6be6f86b900482

    SHA1

    59fd876e9889047a2d196d7fe3af1fcf8976426f

    SHA256

    fa3c02b9f016a6f2b4313e98109c04f4a9707cab61f6c83712971b972d12581a

    SHA512

    4cbc6339e898593b7f424b0e42d5f24d324ea94f931cdb3bbc2afedd69ecad3e17e83a141df042dcf6f88d2b1fb5a193669cdcb0e6dd613123af937c806c60a0

    Download Submit
  • C:\Windows\SysWOW64\uxqzuhmd.exe
    Filesize

    512KB

    MD5

    604091f9bfee5bf2db033ca3d67d05ec

    SHA1

    240407bde34b02bbce70ad19ea2f05c77092384d

    SHA256

    904ac39d0883f6a4bcf8326c2347ed5adc81a34806a9ebb6855879989c2efca9

    SHA512

    bce3345d286d9d58773545637f013e91d2dd5a5a9f117c7bd8951afe371d068bc467adf20d8f8ad9780100bda33b887dc3f298d5ff89f21339c569159efdd7b9

    Download Submit
  • C:\Windows\SysWOW64\yiujeprxil.exe
    Filesize

    512KB

    MD5

    8cd7c2303089f00d8963ba17c3c34223

    SHA1

    000749b8b0521e3eccdf9154789f9695bd3cf2f1

    SHA256

    b0c8008f62d131f94f499baac02bb6c509950515442f9de751f2069fe96a5256

    SHA512

    eb3e4f5766bcfc6797d14ef2574c56bb5e4dfaef0ed6e8f48558f2e444073f4ab3ab56c89c2dde16d01ffe19fbbabd9aab58ec08b69c516d2ad33e3053fc9a88

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    ccc6329daee8890a96834dc41243deaf

    SHA1

    8a9fb0510e89a770875c51a033354af2490fc9e4

    SHA256

    911fedd6c9bac090d0eb68df63fb6ed11cbd05535d3d76bdba2450200b75ff11

    SHA512

    b6268e3247b63d7345b56b8e1ed2ecf8720a57b2fb4aede89f73ce79a163151a614d781b692f86da64a2400c6c06dfe2c365b28509fa0fb2c4fbc4c9da69aaeb

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    7b454d10d8b9497187dd4fb17dc146c8

    SHA1

    bf67240ac6c85220bf317d96f99df866709eec5e

    SHA256

    03df96b3a94524d6f91453d4407fa15bdbd0285868548d86cb8316135e4b619e

    SHA512

    dc1196741b6671f87a089cac5d0bc8fdaca1b6eca9173c5e409fddf03877fc2a90b3444c424c0083c97569192c243bd828f5f2777d72c12a18584cd74d81fc64

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    512KB

    MD5

    22d347ba95e0b390ba082e0b6e06f55b

    SHA1

    40b4fea2f661c656e061368390da6feae926345e

    SHA256

    0d00b61d0a0aec4735b498ac0b8b37aa7f6aef57020697ccb4357cb9ffce7ebe

    SHA512

    f824e0fdd0a1d4b85d68c25e9103c69ebaf70affcffd9ca40967869ca9cfb6fb453d52d0ce9777046457757146ed315cb43dfd73129f0f10193807775e95295d

    Download Submit
  • memory/2004-0-0x0000000000400000-0x0000000000496000-memory.dmp
    Filesize

    600KB

    Download
  • memory/3892-36-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-38-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-43-0x00007FFEA7650000-0x00007FFEA7660000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-37-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-39-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-35-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-40-0x00007FFEA7650000-0x00007FFEA7660000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-618-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-620-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-617-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3892-619-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp
    Filesize

    64KB

    Download